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Continuous-variable quantum key distribution (CV-QKD) protocols based on coherent detection 
have been studied extensively in both theory and experiment. In all the existing implementations of 
CV-QKD, both the quantum signal and the local oscillator (LO) are generated from the same laser 
and propagate through the insecure quantum channel. This arrangement may open security loop¬ 
holes and limit the potential applications of CV-QKD. In this paper, we propose and demonstrate a 
pilot-aided feedforward data recovery scheme which enables reliable coherent detection using a “lo¬ 
cally” generated LO. Using two independent commercial laser sources and a spool of 25 km optical 
fiber, we construct a coherent communication system. The variance of the phase noise introduced 
by the proposed scheme is measured to be 0.04 (rad 2 ), which is small enough to enable secure key 
distribution. This technology also opens the door for other quantum communication protocols, such 
as the recently proposed measurement-device-independent (MDI) CV-QKD where independent light 
sources are employed by different users. 

PACS numbers: 03.67.Dd 


I. INTRODUCTION 

Quantum key distribution (QKD) allows two authen¬ 
ticated parties, normally referred to as Alice and Bob, to 
generate a secure key through an insecure quantum chan¬ 
nel controlled by an eavesdropper, Eve mm ■ Based on 
fundamental laws in quantum mechanics, idealized QKD 
protocols have been proved to be unconditionally secure 
against adversaries with unlimited computing power and 
technological capabilities EHH3- 

Both discrete-variable (DV) QKD protocols based on 
single photon detection mm and continuous-variable 
(CV) QKD protocols based on coherent detection 5]- 
111] have been demonstrated as viable solutions in prac¬ 
tice. One well-known CV-QKD protocol is the Gaussian- 
modulated coherent state (GMCS) protocol fTTj, which 
has been demonstrated through an 80km optical fiber 
link recently [12] . One important advantage of the 
GMCS QKD is its robustness against incoherent back¬ 
ground noise. The strong local oscillator (LO) employed 
in coherent detection also acts as a natural and extremely 
selective filter, which can suppress noise photons effec¬ 
tively. This intrinsic filtering function makes CV-QKD 
an appealing solution for secure key distribution over a 
noisy channel, such as a lit fiber in a conventional fiber 
optic network |T3HT5j or a free-space optical link [16] . 

However, all existing implementations of CV-QKD 
based on coherent detection contain a serious weakness: 
to reduce the phase noise, both the signal and the LO 
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are generated from the same laser and propagate through 
the insecure quantum channel [HI Oil 011 [[7] [3 This ar¬ 
rangement has several limitations. First of all, it allows 
Eve to access both the quantum signal and the LO. Eve 
may launch sophisticated attacks by manipulating the 
LO, as demonstrated in recent studies [TSl - ET] . Second, 
sending a strong LO through a lossy channel can drasti¬ 
cally reduce the efficiency of QKD in certain applications. 
For example, to achieve a shot-noise limited coherent de¬ 
tection, the required photon number in the LO is typi¬ 
cally above 10 8 photons per pulse at the receiver’s end 
mmm- With a 1 GHz pulse repetition rate and a 
channel loss of 20 dB, the required LO power at the input 
of the quantum channel is about 1.2 W (at 1550 nm). If 
optical fiber is used as the quantum channel, noise pho¬ 
tons generated by the strong LO inside the optical fiber 
may significantly reduce QKD efficiency and multiplex¬ 
ing capacity. Third, the LO is typically 7 or 8 orders 
of magnitude brighter than the quantum signal, compli¬ 
cated multiplexing and demultiplexing schemes are re¬ 
quired to effectively separate the LO from the quantum 
signal at the receiver’s end [3 

In brief, in CV-QKD, it is desirable to generate the 


1 Note in m , continuous polarization states (that contain the 
signal encoding as well as a LO in the same spatial mode) are 
prepared and sent over a free-space link in a polarization mul¬ 
tiplexed setting. Such a configuration can automatically offer a 
high interferometric visibility. 

2 Note, the second and third problems discussed above might be 

solved by sending a weak LO from Alice and applying optical 
amplification at Bob’s side. 
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LO “locally” using an independent laser source at the 
receiver’s end. Unfortunately, such a scheme has never 
been implemented in practice. The main challenge is how 
to effectively establish a reliable phase reference between 
Alice and Bob. While various techniques, such as feedfor¬ 
ward carrier recovery [22], optical phase-locked loops [23], 
and optical injection phase-lock loop [ 23 ], have been de¬ 
veloped in classical coherent communication, these tech¬ 
niques are not suitable in QKD where the quantum signal 
is extremely weak and the tolerable phase noise is low. 
Furthermore, to prevent Eve from manipulating the LO, 
the LO laser should be isolated from outside both opti¬ 
cally and electrically. 

In this paper, we solve the above long outstanding 
problem by proposing and demonstrating a pilot-aided 
feedforward data recovery scheme, which enables reli¬ 
able coherent detection using a “locally” generated LO. 
This scheme is built upon the observation that in the 
GMCS QKD, Bob does not need to perform the mea¬ 
surement in the “correct basis”. In fact, Bob can per¬ 
form the measurement in an arbitrarily rotated basis as 
along as the basis information (the phase reference) is 
available afterwards. With this post-measurement ba¬ 
sis information, either Alice or Bob can rotate data at 
hand and generate correlated data with the other. We 
demonstrate the above scheme in a coherent communi¬ 
cation system constructed by a spool of 25 km optical 
fiber and two independent commercial laser sources op¬ 
erated at free-running mode. The observed phase-noise 
variance is 0.04 (rad 2 ), which is small enough to enable 
secure key distribution. This technology also opens the 
door for other novel quantum communication protocols, 
such as the measurement-device-independent (MDI) CV- 
QKD protocol [25H27] where independent light sources 
are employed by different users. 

This paper is organized as follows: in Section [XT] we 
conduct a theoretical analysis of the proposed scheme. 
In Section III we present the details of proof-of-principle 
experiments. We conclude this paper with a discussion 
in Section ITVl 


II. THEORETICAL ANALYSIS 

In GMCS QKD, Alice draws two random numbers X'a 
and Pa from a set of Gaussian random numbers (with a 
mean of zero and a variance of VaNq), prepares a coher¬ 
ent state | Xa + iPa) accordingly, and sends it to Bob. 
Here No = 1/4 denotes the shot-noise variance. At Bob’s 
end, he can perform either optical homodyne detection 
or optical heterodyne detection. 

In GMCS QKD protocol based on homodyne detection 
m, Bob randomly chooses to measure either the am¬ 
plitude quadrature (X) or phase quadrature (P) of the 
incoming signal. Later on, he announces which quadra¬ 
ture he measures for each incoming signal through an 
authenticated public channel, and Alice only keeps the 
corresponding data. In GMCS QKD based on hetero¬ 


dyne detection [2S], Bob first splits the incoming signal 
into two with a 50:50 beam splitter. He then measures 
X at one output port and P at the other. In this case, 
Alice keeps all her quadrature data. 

After the quantum transmission stage, Alice shares 
a set of correlated Gaussian random variables (called 
the “raw key”) with Bob. Alice and Bob compare a ran¬ 
dom sample of the raw key through an authenticated 
classical channel to estimate the transmittance and ex¬ 
cess noise of the quantum channel. If the observed excess 
noise is small enough, they can further work out a secure 
key. 

In the above description, we have implicitly assumed 
that Alice and Bob share a phase reference, so Bob can 
perform the required quadrature measurement. If the 
LO is generated for an independent laser source, how can 
Alice and Bob establish a phase reference in this case? 

In this section, we present a pilot-aided phase esti¬ 
mation scheme which allows Alice and Bob to measure 
the phase relation between two independent lasers in real 
time. Using this phase information either Alice or Bob 
can rotate the data at hand in the post-processing stage 
(“quadrature remapping”) and establish correlation with 
the other. In principle, our scheme can be applied to both 
CV-QKD with homodyne detection and the one with het¬ 
erodyne detection. In this paper, we focus on the case 
of heterodyne detection. For an independent and related 
work, see [25] , 


A. CV-QKD using quadrature remapping scheme 

In a phase coding DV-QKD protocol, it is also crucial 
to control the phase between a signal pulse and a ref¬ 
erence pulse when performing interferometric measure¬ 
ment. In fact, a DV-QKD protocol using a strong phase- 
reference pulse has been proposed in [30] . In this scheme, 
Alice sends Bob a quantum signal together with a strong 
phase reference pulse generated from the same laser. At 
Bob’s side, he interferes the strong phase reference pulse 
with a sampling beam from his LO laser to determine 
the phase difference between the two lasers, corrects this 
phase difference by introducing a phase shift to his LO 
laser, and then performs an interfeometric measurement 
on the quantum signal using the phase-corrected LO 
pulse. However, the above scheme has not been demon¬ 
strated yet, possibly due to the following reasons: first, 
the phase difference between two remote independent 
lasers is expected to fluctuate rapidly, this makes real¬ 
time phase feedback control very challenging. Secondly, 
different types of detector are required for phase mea¬ 
surement and quantum signal detection, this increases 
the complexity of the overall system. As we will show 
below, the above two challenges can be overcome in a 
CV-QKD protocol. 

Suppose in a CV-QKD system based on heterodyne 
detection, both the signal laser and the LO laser are op¬ 
erated in free-running mode. Without loss of generality, 
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for each transmission, we can choose the phase of the 
signal laser as the phase reference (0s = 0). When Bob 
performs conjugated homodyne detection, the phase 0 of 
his LO laser can be treated as a random variable. Bob’s 
measurement results ( Xb,Pb ) are given by (after scaling 
with the channel transmittance) 

Xb = Xacosc/) + Pasitu p + Nx 

Pb = — XAsin(j) + Pacosc/) + Np (1) 

where Nx and Np are assumed to be i.i.d. Gaussian 
noises with zero mean. 

If Alice and Bob can determine 0 after Bob has per¬ 
formed his measurement, one of them (for example, Bob) 
can use this post-measurement phase information to cor¬ 
rect his data by performing the following rotation 

X B = X B cos(f> — P B sirup 

P B = X B sirup + P B coscp (2) 

From equations (1) and (2), it is easy to show 

X B = Xa + N x 

P B = Pa + Np (3) 

where the noise terms in the rotated data are given by 

N x = Nxcosrp — Npsirup 

N P = Nxsirup + Npcosrp (4) 

Given N x and Np are i.i.d. Gaussian noises, it is easy 
to see that N x and N P are also independent Gaussian 
noises with the same variance as N x and Np. This sug¬ 
gests that the rotation process will not introduce addi¬ 
tional noise if the phase 0 can be determined precisely. 

The above “quadrature remapping” scheme allows Al¬ 
ice and Bob to establish correlated data without using 
a complicated phase feedback control system, thus re¬ 
moving the first challenge listed at the beginning of this 
section. Next, we will present a scheme which allows 
Alice and Bob to determine 0 under realistic scenarios 
using the same detector for quantum signal detection, 
thus removing the second challenge listed above. 

B. Pilot-aided phase recovery scheme 

If the drift of phase 0 is slow enough such that within 
a frame time of AT (within which the phase 0 can be 
treated as a constant), many rounds of quantum trans¬ 
mission can be conducted, the following scheme can be 
applied to estimate the phase 0. After the quantum 
transmission stage, for each frame, Alice can randomly 
choose a subset of the transmitted signals as calibration 
pulses and announce the encoded data through an au¬ 
thenticated channel. Using the corresponding measure¬ 
ment results at hand, Bob can estimate phase 0 for this 
frame using equation (1). Since Alice’s signals are at 
quantum level, each individual calibration pulse cannot 


provide a precise estimation of the phase 0. However, 
by averaging the results acquired from a large number of 
calibration pulses, the phase noise can be reduced effec¬ 
tively. This scheme was first proposed and implemented 
in m to reduce the noise associated with the slow phase 
drift of a fiber interferometer in GMCS QKD. 

Unfortunately, the above scheme is not practical when 
the quantum signals and the LOs are generated from in¬ 
dependent laser sources. On one hand, the phase dif¬ 
ference between two practical lasers fluctuates rapidly 
due to the laser frequency instability and the phase noise 
associated with the finite laser linewidth; on the other 
hand, the maximum transmission rate of CV-QKD is 
limited by the bandwidth of shot-noise limited optical 
coherent detector. As such, we cannot acquire an accu¬ 
rate estimation of 0 by measuring quantum signals. 

To solve the above problem, we proposed a pilot-aided 
feedforward data recovery scheme [31]. The basic idea is 
as follows. For each quantum transmission, Alice sends 
out both a quantum signal and a relatively strong phase 
reference pulse generated from the same laser. The quan¬ 
tum signal carries Alice’s random numbers, as in the case 
of conventional CV-QKD. The reference pulse, on the 
other hand, is not modulated. These two pulses propa¬ 
gate through the same quantum channel to the measure¬ 
ment device, where Bob performs conjugate homodyne 
detection on both of them using LOs generated from the 
LO laser. Note, to avoid detector saturation, Bob can 
use a relatively weak LO to measure the reference pulse. 

The measurement results from the phase reference 
pulse (X B , Pp) can be used to determine 0 using 

0 = — tan -1 —^— (5) 

Xr 

where the minus sign is due to the definition of phase 
reference. By using a relatively strong reference pulse, 
Bob can acquire an accurate estimation of 0 and use this 
phase information to implement the quadrature remap¬ 
ping scheme. 

In this paper, we study a simple implementation of 
the above scheme, where Alice sends out quantum sig¬ 
nals and reference pulses alternately and periodically, as 
shown in Figure 1. We remark that if the drift of phase 
0 is slow enough compared with the transmission rate 
of QKD, it is possible to use fewer reference pulses to 
improve QKD efficiency. 

In Fig.l, a quantum signal S) and the corresponding 
reference pulse Ri are measured at different times with 
a time delay of X0 If the frequency difference of the 
two lasers (/i — 02 ) is a constant and can be precisely 
determined, we can estimate phase (ps.i at the time when 
Sj is measured from the phase measurement result of Ri 
by simply adding a constant phase shift of 27 t(/i — f-^Td- 
In practice, however, both lasers present slow frequency 
drift over time. Here, we use a simple scheme to estimate 
4>s,i- Since the signal pulse Si is in the middle of two 
reference pulses Ri and Ri+i, we can estimate <fis,i from 
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^i+l ^i+1 



time 


FIG. 1: Distribution of quantum signals ( S ) and 
reference pulses ( R ). 


( 6 ) 


the phase measurement results on R t and Ri+\ as 

-T R,i + 4>R,i +1 

$8,i = -2- 

Note the above equation can also be written as 

4>s,i = <!>R,i + 2l: Jd T d (7) 

where f d = ' - < ^ >R ' 1 can be interpreted as the fre- 

47i-T d 

quency difference of the two lasers within the short time 
interval between two adjacent reference pulses. 

While similar to classical intradyne detection, a key 
difference in our scheme separates phase recovery of a 
quantum signal from that of a classical one. A phase 
reference cannot be recovered reliably from a quantum 
signal while it can in the classical case, meaning that the 
reference pulses here must be used to estimate that phase 
of the LO and quantum signal during the time window in 
which the quantum signal arrives. This places additional 
stringent requirements on relative laser noise compared 
to the classical case. 


C. Security analysis 

In this section, we will show that the existing secu¬ 
rity proofs of conventional CV-QKD iTT2TfTT4l (built upon 
the assumption that Eve can only access the quantum 
signals) can be applied in our scheme directly. 

First, the phase reference pulses are only used to pro¬ 
vide (classical) phase information, they are not directly 
used in the coherent detection of the quantum signals. 
In fact, in our scheme Eve can never access the LO it¬ 
self. Note, a standard assumption in CV-QKD is that 
Eve can have full knowledge of the phase reference used 
in quantum state preparation/coherent detection, so the 
reference pulses will not give Eve any additional informa¬ 
tion. Eve can certainly interfere with the phase recovery 
process by manipulating the phase reference pulses when 
they propagate through the quantum channel. This could 
result in an increased phase noise and the secure key rate 
will be reduced. This is one type of denial-of-service at¬ 
tack, which can be applied to any QKD protocols. From 
Eve’s point of view, whatever can be achieved by manip¬ 
ulating the reference pulses can also be achieved by ma¬ 
nipulating the quantum signals directly. In brief, sending 
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FIG. 2: Security models. HD-heterodyne detection, (a) 
CV-QKD protocol using quadrature remapping scheme; 
(b) A virtual QKD scheme equivalents to (a); (c) 
Conventional QKD scheme. 


phase reference pulses through the quantum channel will 
not cause any security problem. 

Next, we will show the security of the CV-QKD pro¬ 
tocol using quadrature remapping scheme is equivalent 
to that of the conventional CV-QKD protocol. To illus¬ 
trate the essential ideas, it is convenient to represent the 
phase recovery scheme by a separate classical commu¬ 
nication channel, which can be fully controlled by Eve. 
Fig.2 (a) is a schematic diagram of Bob’s system in our 
new QKD scheme. In this picture, Bob performs a het¬ 
erodyne measurement on the incoming quantum signal, 
then rotates his measurement results using the phase (f> 
estimated through the classical communication channel. 
In [35], the authors proved that a unitary phase rotation 
commutes with heterodyne detection. More specifically, 
Bob can either rotate the optical phase of the quantum 
signal first, then perform heterodyne detection, or he can 
perform heterodyne detection first, then rotate the classi¬ 
cal measurement results in the post-processing stage. So 
the protocol shown in Fig.2 (a) is equivalent to the vir¬ 
tual QKD protocol shown in Fig.2 (b). Since the classical 
phase estimation channel can be controlled by Eve, we 
can move the phase rotation operator out of Bob’s secure 
station and let Eve to have full control of it, as shown in 
Fig.2 (c). Note the QKD protocol shown in Fig.2 (c) is 
exactly the conventional CV-QKD based on heterodyne 
detection, where Eve is allowed to manipulate the quan¬ 
tum signals transmitted through the channel at her will. 
So, the security of our new QKD scheme is equivalent to 
that of the conventional CV-QKD protocol. 

While we do not need to develop a new security proof 
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for the proposed QKD scheme, to achieve a high secure 
key rate, it is important to reduce the noise of the phase 
recovery process. From Eq. the uncertainty of <f> 
will be translated into an excess noise in (X B ,P B ) (after 
scaling with the channel transmittance) as 

( 8 ) 

where Va is Alice’s modulation variance, <j^ is the noise 
variance in determining phase <f >. This extra noise £0 
will reduce secure key generation rate. It is thus very 
important to minimize the phase noise 

In next section, we will study the performance of the 
proposed phase recovery scheme under realistic scenario. 



FIG. 3: Experimental setup. S-signal laser; L-LO laser; 
IM-optical intensity modulator; PM-optical phase 
modulator; AWG-arbitrary waveform generator; 
SMF-25km single mode fiber spool; PC- polarization 
controller; BD-balanced photodetector; 
OSC-oscilloscope. 


III. PROOF OF PRINCIPLE DEMONSTRATION 
A. Noise model 

There are two major noise sources in determining 
phase <j> using Eq.( 6 ). The first one is the measurement 
noise when Bob tries to determine <pR,i (</>-R,i+i) of the ref¬ 
erence pulses Ri (Ri- (_i). This noise could be significant 
when the reference pulses become extremely weak thus 
the contribution of shot noise cannot be ignored. How¬ 
ever, in practice, we can use a relative strong reference 
pulse to reduce the contribution of the shot noise. For 
example, if the average photon number of the reference 
pulse (at Bob’s heterodyne detector) is 1000, given the 
detection efficiency of the heterordyne detector is 50%, 
the phase noise variance due to the shot noise is about 
0.001, which is negligible in practice. In this paper, we 
simply ignore this noise contribution. 

The second noise source is the quantum phase noise 
of the laser, which originates from the amplified spon¬ 
taneous emission. More specifically, even we know the 
phase of the reference pulse, we still cannot determine 
the phase of the signal pulse precisely since they are gen¬ 
erated at different times. The spontaneous emitted pho¬ 
tons generated within the above time interval contribute 
a fundamental phase noise. Since the laser phase noise 
cannot be reduced by simply increasing the amplitude 
of the reference pulse, it is the main noise source in our 
scheme. 

Define the laser phase at time t = 0 as 9q. The phase 
noise A 6(t) quantifies the deviation of the laser phase at 
time t from 9 0 + 27t ft (the phase expected from an ideal 
sine wave), where / is the central frequency of the laser. 
A 9{t) can be modeled as a Gaussian random variable 
with a mean of zero and a variance of [36] 

Of 

((A 9(t)f) = -. (9) 

Here t c is the coherence time of the laser. For a laser 
with lorentzian lineshape, r c is related to its lincwidth 
A / by [31; 


As shown in Appendix A, given the phase noise of the 
signal laser and that of the LO laser are ((A 9s(t)) 2 ) and 
((A^i(t)) 2 ) respectively, the noise variance of our phase 
estimation scheme (Eq.( 6 )) is described by 

** = \ {((A e s {T d )f) + ((A e L {T d )f )}, (11) 

where Td is the time delay between the signal pulse and 
the reference pulse (see Fig.l). 


B. Experimental setup 

We demonstrate the pilot-aided feedforward data re¬ 
covery scheme using commercial off-the-shelf devices. 
The experimental setup is shown in Fig.3. Two commer¬ 
cial frequency-stabilized continuous wave (cw) lasers at 
Telecom wavelength (Clarity-NLL-1542-HP from Wave¬ 
length Reference) are employed as the signal and the LO 
laser. Both lasers are operated at free-running mode with 
no optical or electrical connections between them. The 
central frequency difference between the two lasers can 
stay within 10 MHz without doing any feedback controls. 
A LiNb03 waveguide intensity modulator (EOSpace) is 
used to generate 8 ns laser pulses at a repetition rate of 
50 MHz. Since half of the laser pulses are used as phase 
references, the equivalent data transmission rate in our 
experiment is 25 MHz. A LiNb03 waveguide phase mod¬ 
ulator (EOSpace) is used to modulate the phase of the 
signal pulses. 

Both the signal pulses and the reference pulses propa¬ 
gate through a spool of 25km single mode fiber before ar¬ 
riving at the measurement device. A commercial 90° op¬ 
tical hybrid (Optoplex) and two 350 MHz balanced am¬ 
plified photodetectors (Thorlabs) are employed to mea¬ 
sure both X-quadrature and P-quadrature of the incom¬ 
ing pulses. The 90° optical hybrid is a passive device 
featuring a compact design. No temperature control is 
required to stabilize its internal interferometers. The out¬ 
puts of the two balanced photodetectors are sampled by 
a broadband oscilloscope at 1 GHz sampling rate. For 
simplicity, the LO laser is operated at the cw mode. A 
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waveform generator with a bandwidth of 120 MHz pro¬ 
vides the modulation signals to both the intensity and 
the phase modulator, and a synchronization signal to the 
oscilloscope. 


C. Experimental results 

To evaluate the effectiveness of the phase recov¬ 
ery scheme, we conduct a phase encoding coherent 
communication experiment using a binary pattern of 
“ 01010101 ...”, where bit 0 is represented by no phase 
shift and bit 1 by phase shift of 1.65rad. The phase 
modulator shown in Fig.3 is used to encode binary phase 
information on the signal pulses. The amplitude of the 
signal pulse is the same as that of the reference pulse. At 
the receiver’s end, the average photon number per pulse 
is about 10 5 , which is significantly lower than that of the 
LO used in a typical GMCS QKD experiment. Note, 
in this experiment, to determine the noise of the phase 
recovery scheme, strong signal pulses are employed to 
provide “true” values of the phases to be estimated. 

In total, 25000 signal pulses and 25000 reference pulses 
are transmitted. For each pulse received by Bob, its 
phase is calculated from the measured quadrature val¬ 
ues {X, P} using Eq.(5). The phase measurement re¬ 
sults from the signal pulses |</>s i = 1, 2,...25000 } 

are shown in Fig.4(a) and (b). Due to the random phase 
change between the signal laser and the LO laser, the 
measured phases are randomly distributed within [ 0 , 2tt), 
regardless the encoded phase information. 

From the phase measurement results of the reference 
pulses = 1,2, ...25000}, we recover a phase refer¬ 

ence <j) Si for each signal pulse using Eq.( 6 ), and correct 
the raw measurement results by 

47> = 47" , + 0 w ( i2) 

The corrected phase measurement results 

{47\i = 1,2, ...25000} are shown in Fig.4(c) and 

(d). After the phase correction, the measurement results 
for bit 0 and bit 1 are clearly separated. 

The variances of the residual phase noise (the differ¬ 
ence between and the phase information encoded 

by Alice) have been determined to be 0.040 ± 0.001 (for 
bit 0) and 0.039 ± 0.001 (for bit 1) respectively. 

Note in the above experiment, relatively strong refer¬ 
ence pulses have been employed. While this will not in¬ 
troduce any security problem, in practice, it may be more 
convenient to use weak reference pulses. We conduct ex¬ 
periments to determine phase noise variance using 
reference pulses with different average photon numbers 
(10000,1000,100). The measured phase noise variance 
are (0.039 ± 0.001,0.040 ± 0.001,0.054 ± 0.001). These 
results show that the phase recovery scheme works well 
even with reference pulses containing only a thousand 
photons. 
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Uncorrected phase measurement results (bit 0) 
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FIG. 4: Histograms of the phase measurement results, 
(a) The measurement results corresponding to bit 0 
(before phase correction); (b) The measurement results 
corresponding to bit 1 (before phase correction); (c) 
The measurement results corresponding to bit 0 (after 
phase correction); (d) The measurement results 
corresponding to bit 1 (after phase correction). 


As we have discussed in the previous section, the main 
noise source in our setup is laser phase noise associated 
with its finite linewidth. We conduct experiments to de¬ 
termine the phase noise of each laser. For T ,} = 20ns 
(which corresponds to the 50MHz pulse repetition rate in 
the above experiments), the phase noise of the two lasers 
has been determined to be 0.035±0.001 and 0.044±0.001, 
see details in Appendix A. From Eq.(ll), the expected 
noise of the phase recovery scheme is = 0.040 ± 0.001, 
which matches with the experimental results very well. 
To further reduce the noise a 0 , we can either use a smaller 
time delay Td (which is ultimately limited by detector 
bandwidth), or choose lasers with a narrower linewidth. 

As another demonstration of the phase recovery 
scheme, we conduct an experiment by using the phase 
reference recovered from the reference pulses to remap 
quadrature values measured with weak quantum signals. 
In this experiment, no phase information is encoded on 
the signal pulses. The average photon number of each 
reference pulse at the receiver’s end is about 1000 , while 
that of each signal pulse is 66 . Fig.5 shows the quadrature 
values (X, P ) of the signal pulses in phase-space (sample 
size is 24000). The figure on the left shows the raw mea¬ 
surement results, where the phase randomly distributed 
in [0,27 t) as expected. The figure on the right shows 
the results after performing quadrature remapping. More 
specifically, we first recover a phase reference <f> s , for each 
signal pulse using Eq.( 6 ), and then rotate the raw data 
using Eq.(2). The quadrature values have been scaled 
by taking into account the 3-dB loss due to heterodyne 
detection and the 50% overall efficiency of the detection 
system. The noise variance in the X-quadrature (right 
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FIG. 5: The measured quadrature values in phase 
space. Left-before quadrature remapping; Right “after 
quadrature remapping. 


figure) has been determined to be 1.83 in shot noise units. 
This suggests the excess noise of the detector (includ¬ 
ing noise from the commercial balanced photo-detector 
and the oscilloscope) is about 0.83 in shot-noise units. 
Note, due to the residual phase noise of the phase re¬ 
covery scheme, the distribution shown in the right fig¬ 
ure is not symmetric: the variance of P-quadrature (A p) 
is larger than that of X-quadrature (Ax). The phase 
noise a$ in the above experiment can be estimated by 
<70 = (A p — Ax)/A'g, where A' 0 is the mean value of 
X-quadrature. The experimental result is (0.034 ± 0.01), 
which is consistent with the noise variance estimated with 
strong signal pulses. This shows the proposed phase re¬ 
covery scheme works well in both the classical and the 
quantum domain. Note the uncertainty in this measure¬ 
ment is higher than that in previous experiments, since 
we estimate a small quantity (er^,) from the difference of 
two relatively large quantities (A p and Ax). 

Given the noise of the phase recovery scheme, we can 
use Eq.(8) to determine the additional excess noise con¬ 
tributed by this scheme and estimate the secure key rate 
using existing security proof of GMCS QKD. In appendix 
B, we present simulation results based on practical sys¬ 
tem parameters. Under the “realistic” model HU where 
Eve cannot control the noise and loss of Bob’s detector, 
secure key can be generated over a distance of 120knr 
through telecom fiber. To estimate the finite data size 
effect, we also conduct simulations using the most recent 
composable security proof of CV-QKD [33]. 


IV. DISCUSSION 

A long outstanding problem in CV QKD based on co¬ 
herent detection is how to generate the LO “locally”. In 
all the existing implementations of CV-QKD, both the 
quantum signal and the LO are generated from the same 
laser and propagate through the insecure quantum chan¬ 
nel. This arrangement may open security loopholes and 
also limit the potential applications of CV-QKD. 

In this paper, we solve the above problem by propos¬ 


ing and demonstrating a pilot-aided feedforward data re¬ 
covery scheme which allows reliable coherent detection 
using a “locally” generated LO. This scheme also greatly 
simplifies the CV-QKD design by getting rid of the cum¬ 
bersome unbalanced fiber interferometers and the asso¬ 
ciated phase stabilization system. Proof of principle ex¬ 
periments based on commercial off-the-shelf components 
show that the noise due to the proposed scheme is tol¬ 
erable in CV-QKD. To further reduce the noise, laser 
sources with a smaller linewidth can be applied. 

We remark that the measurement device employed 
in our experiment is essentially an intradyne detection 
scheme which has been applied in classical coherent com¬ 
munication for carrier phase recovery [37] I38| . It is thus 
convenient to name our new scheme as “intradyne” CV- 
QKD while the conventional scheme as “self-homodyne” 
CV-QKD [39]. However, there are several important 
differences between the classical and the quantum case. 
First, in classical communication, the signals are strong 
and the modulation scheme (such as BPSK and QPSK) 
is relatively simple. This allows carrier phase recovery 
from the signals directly. In GMCS QKD, the quantum 
signals are extremely weak and the modulation scheme 
is more complicated, the carrier phase cannot be recov¬ 
ered from the quantum signals reliably. Thus it is neces¬ 
sary to employ relatively strong reference pulses. Second, 
the transmission rate of a classical communication sys¬ 
tem can reach 100GHz, while the transmission rate of a 
state-of-the-art GMCS QKD system is below 100MHz. 
This places a more stringent requirement on laser phase 
noise in the quantum system. Third, a classical digital 
communication system can tolerate higher phase noise 
than the CV-QKD. In brief, it is much more challenging 
to recover carrier phase in quantum communication. 

Although a complete CV-QKD experiment using the 
proposed scheme is not presented in this paper, all the 
components required to implement such a system, in¬ 
cluding broadband shot-noise limited homodyne detec¬ 
tors FT01TT21 . have been well developed. In fact, the struc¬ 
ture of the proposed QKD system is much simpler com¬ 
pared to the conventional scheme [T2]. 

We remark that a similar CV-QKD scheme has been 
independently proposed by Soh et al. (23;. In (23], Soh et 
al. study the expected secure key rate of their protocol 
under a passive channel taking into account the effects 
of quantum noise on the reference pulse, and show in 
what limit the reference pulse scheme achieves the same 
performance as the standard scheme (where an LO is 
transmitted). They further conduct a proof-of-principle 
QKD experiment in the presence of strong phase noise 
between Alice’s signal pulses and Bob’s LO pulses gener¬ 
ated from the same laser. In our study, we establish the 
security of the proposed QKD protocol by showing that 
it is equivalent to the conventional GMCS QKD proto¬ 
col, thus the well-established security proof can be ap¬ 
plied directly. Our proof-of-principle demonstration fo¬ 
cuses on establishing a reliable phase reference between 
two independent lasers over a 25km optical fiber link, a 
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FIG. 6 : Phase noise analysis. 


BD 



FIG. 7: Experimental setup for determining laser phase 
noise. L-laser; BS-fiber beam splitter; PC-polarization 
controller; BD-balanced photodetector; 
OSC-oscilloscope. 


practical scenario that the proposed protocol is designed 
for. We expect our scheme will be widely adopted in 
CV-QKD. This technology also opens the door for other 
quantum communication protocols, such as the MDI-CV- 
QKD protocol. 

We would like to thank Hoi-Kwong Lo and Paul 
Jouguet for very helpful discussions. This work was per¬ 
formed at Oak Ridge National Laboratory, operated by 
UT-Battelle for the U.S. Department of Energy under 
Contract No. DE-AC05-00OR22725. The authors ac¬ 
knowledge support from the laboratory directed research 
and development program. 


Appendix A: Laser phase noise 

In this Appendix, we will first derive Eq.(ll), which 
quantifies the contribution of laser phase noise to the 
noise variance of the phase recovery scheme. Then we 
will present details of experiments where the phase noise 
of each laser is measured. 

For simplicity, we consider the case that the phases of 
two reference pulses measured at time tg and are used 
to estimate the phase difference of the signal laser and 
the LO laser at time ti, as shown in Fig. 6 . 

Assume that the phases of the signal laser and the LO 
laser at time {toAiiA} are {cr 0 , cri, cr 2 ; /3o 3 /3i 5 /^ 2 } corre¬ 
spondingly. The phase difference of the two lasers at the 
above times are given by 

</>o = Po — O' 0 

01 = A - oi 

02 = A ~ a 2 - (Al) 

The phases of the signal laser at different times are 
related by 

ai = a 0 + 2nf s T d + N s ,i 

02 = o\ + 2tt fsT d + Ns, 2 , (A2) 

where fs is the central frequency of the signal laser. N$,i 
and Ng ,2 are independent Gaussian noises with a mean 
of zero and a variance of ((A 9s(T d )) 2 ). 


Similarly, the phases of the LO laser are related by 

A = A) + 2 nf L T d + N la 

A=A + 2t Tf L T d + N Lt2 , (A3) 

where /q is the central frequency of the LO laser. Ab,q 
and Nl£ are independent Gaussian noises with a mean 
of zero and a variance of ((AA(Td)) 2 ). 

We assume that 0o and 0 2 can be determined precisely 
by using strong reference pulses. From Eq.(6) and using 
Eqs.(Al-A3), phase 0i can be estimated by 

— 00+02 
*i = —r~ 

= 0, + JV «.i + Ar ^ (A4) 

Since all the above noise terms in Eq. (A4) are in¬ 
dependent with each other, it is easy to show the noise 
variance of the phase recovery scheme is given by 

0>i = ((0i - 0i) 2 ) 

= \ {((A 9 s (T d )) 2 ) + ((A e L {T d )) 2 )} . (AS) 

This is Eq.(ll) in the main text. 

We conduct experiments to determine the laser phase 
noise ((A Os(T d )) 2 ) and ((A 9 L (T d )) 2 ). The experimental 
setup is shown in Fig.7. The cw output of a laser is split 
into two beams by a symmetric fiber splitter. After the 
the two beams passing through two separate fiber links, 
the phase difference between the two beams are measured 
with a 90° optical hybrid, two balanced photodetectors, 
and an oscilloscope. 

Given the time delay difference between the two fiber 
links is T d , we can determine the phase noise ((A 6(T d )) 2 ) 
of each laser directly. The phase noise of both the signal 
laser and the LO laser are measured at time delay T d = 
(5ns, 20ns, 25ns). The experimental results are shown 
in Fig.8. As expected from Eq.(9), the observed laser 
phase noise linearly depends on T d . At T d = 20ns, the 
phase noise of the two laser has been determined to be 
0.035 ± 0.001 and 0.044 ± 0.001. 
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FIG. 8: Measured laser phase noise at different time 
delay T d . ‘o’-LO laser; ‘+’-signal laser. 


Appendix B: Simulation of secure key rate 
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FIG. 9: Simulation results based on realistic 
parameters. 


The security of one-way GMCS QKD has been well 
established. Here, our simulations are based on secure 
key rate formulas given in [53]. 

The secure key rate under the optimal collective attack, 
in the case of reverse reconciliation, is given by 

R = JIab — Xbe (Bl) 

where Iab is the Shannon mutual information shared 
between Alice and Bob; / is the efficiency of the rec¬ 
onciliation algorithm; \be is the Holevo bound of the 
information between Eve and Bob. 

The mutual information between Alice and Bob is 
given by 

lAB=log 2 \ +Xt °* (B2) 

1 + Xtot 


where 


{T(y + xtot)Y [Axlet + B + 1 + 2xhet 

{Wb + T(V + Xline)) + 2 T(V 2 - 1)] 


(B8) 


( V + VB Xh et \ 

\ T(V + xtot) ) 


(B9) 


A 5 = 1 


(B10) 


System parameters in the above equations are defined 
as follows. 


The Holevo bound of the information between Eve and 
Bob is given by 


(a) V = Va + 1, where Va is Alice’s modulation vari¬ 
ance. 


i =1 v 7 i =3 v 

where G(x) = (x + 1 )log 2 {x + 1) — xlog 2 X 


(B3) 


A 2 - 1 

Al - 2 ~ 2 L 


A± \JA 2 - 4 B 


(B4) 


where 


A = V 2 (l~2T) + 2T + T 2 (V + X Une ) 2 (B5) 
B = T 2 (V Xline + l) 2 (B6) 


1 r 


a 3,4 — “ 


2 L 


C± sjc 2 - 4 D 


(B7) 


(b ) The total noise referred to the channel input Xtot = 
Xline A ' rp i where T is the channel transmittance. 

If we assume the quantum channel between Alice 
and Bob is optical fiber with an attenuation coeffi¬ 
cient of a, then the channel transmittance is given 
by T = 10to^, where L is the fiber length. 

(c) The total channel-added noise referred to the chan¬ 
nel input Xline = — 1 + e, where e is the excess 

noise outside of Bob’s system. We assume that £ is 
mainly due to imperfection of the LO phase recov¬ 
ery scheme 


£ = V A a 4 , (Bll) 

where a 4 is the noise variance associated with the 
LO phase recovery scheme. 
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FIG. 10: Secure key rate simulation results for a finite 
number of pulses. 


(d) The detection-added noise referred to Bob’s input 
Xhet = [1 + (1 - 77 ) + 2v e i\/ri, where v e i and 77 are 
detector noise and detector efficiency, respectively. 

We conduct numerical simulation using realistic pa¬ 
rameters as summarized below: a = 0.2 dB/krn, v e i = 
0.1, (70 = 0.04, 77 = 0.5, / = 0.95, and V A = 1. Fig.3 
shows the simulation result in the asymptotic case. The 
simulation result shows that the proposed LO phase re¬ 
covery scheme can be applied to achieve efficient QKD. 

Note that the secure key rate depicted in Fig. [9] are ob¬ 
tained under the assumption of infinite number of pulses 
sent from Alice to Bob. However, experimentally one 
is always limited to a finite size data sample. To esti¬ 
mate the effect of finite data on the secure key rate we 


also conduct simulation using the most recent compos- 
able security proof [34| . It can be shown (see Eq.(C13) 
in supplemental materials of [33]) that the secure key rate 
under the optimal collective attack is, 


R=( 1 - e rob )((3I AB - /(£ 


max s^max sr^min \ 
> ) 


— x— [A A ep ~ A erat — 2 log 2 — ]) (B12) 

in ze 


where I A b is the Shannon mutual information shared be¬ 


tween Alice and Bob given in Eq.(B2); /3 is the efficiency 


of the reconciliation algorithm; / is the upper bound of 
the Holevo information xbe between Eve and Bob cal¬ 
culated in supplemental materials of [31] (Eqs.(B2,C9- 
Cll)); c ro b is the protocol robustness parameter; A ent = 

log 2 i - ^8n log 2 (4n) log 2 (l/e) and A ent = sj2n[{d + 
l ) 2 + 4 (d + l)log 2 ( 2 /e 2 m ) + 21 og 2 ( 2 /e 2 e sm )] - 4 e sm d/e. 
For our simulations, following [34], we choose protocol 
parameters such that it is e-secure against collective at¬ 
tacks with e = 10 -20 and e COT .-correct with e cor < 10~ 2 
by setting e sm = e = 10~ 21 ,e PE = e C or = e ent = 10 -41 . 
We also assume that the discretization parameter d = 5 
i.e. each measurement result is placed in one of five 
bins. Similarly to the asymptotic secure key rate sim¬ 
ulations we set the physical parameters a = 0.2 dB/km, 
(70 = 0.04, and V A = 1 and the reconciliation efficiency 
ff = 0.95. In Fig.[l0]we plot the simulated secure key rate 
as a function of the number of pulses transmitted for a 
fixed fiber length L = 10 km assuming perfect detectors 
( v e i = 0, 77 = 1 ). The simulation results indicate that 
a usable secure key can be generated by sending « 10 11 
pulses which is achievable with a CV-QKD system oper¬ 
ated at tens of MHz rate. 
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